CVE-2024-34931
📋 TL;DR
This SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0 allows attackers to execute arbitrary SQL commands through the name parameter in the /model/update_subject.php endpoint. This can lead to unauthorized data access, modification, or deletion. All deployments of version 1.0 are affected.
💻 Affected Systems
- Campcodes Complete Web-Based School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive student/teacher data theft, system takeover via privilege escalation, and potential ransomware deployment.
Likely Case
Data exfiltration of sensitive information (grades, personal data), unauthorized modifications to academic records, and potential authentication bypass.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only read-only access to non-sensitive data.
🎯 Exploit Status
The vulnerability requires no authentication and has publicly available proof-of-concept documentation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to the /model/update_subject.php file
Modify PHP code to use prepared statements: $stmt = $conn->prepare('UPDATE subjects SET name=? WHERE id=?'); $stmt->bind_param('si', $name, $id); $stmt->execute();
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict network segmentation and monitor all database queries from the application
🔍 How to Verify
Check if Vulnerable:
Test the /model/update_subject.php endpoint with SQL injection payloads in the name parameter (e.g., name=test' OR '1'='1)Check Version:
Check the software version in the admin panel or readme filesVerify Fix Applied:
Test that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server, SQL syntax errors in application logs, multiple failed login attempts following SQL injection patterns
Network Indicators:
- HTTP requests to /model/update_subject.php with SQL keywords in parameters, unusual outbound database connections
SIEM Query:
source="web_logs" AND uri="/model/update_subject.php" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR '1'='1*")🔗 References
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2024.pdf
- https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2024.pdf
